Senior Analyst, Vulnerability Operations

Senior Analyst, Vulnerability Operations

Payments Canada, 800-350 Albert Street, Ottawa, Ontario, Canada

Job Description

Payments Canada is at the forefront of the Canadian payment ecosystem. Our purpose is to make payments easier, smarter and safer for all Canadians. Every day we are working diligently to ensure your payments are cleared and settled. In 2025 alone, our systems cleared approximately $103 trillion or $411.9 billion every business day If you are passionate about payments and want to help ensure that these financial transactions in Canada are carried out safely and securely, working with us is for you

Who we are

We are a public purpose, non-profit organization situated at the center of Canada’s payment ecosystem. We own and operate payment systems that process hundreds of billions of dollars’ worth of payment transactions every business day. We convene ecosystem participants to discuss their multiple and diverse interests and ideas and to navigate industry-level challenges. We adhere to a set of values that are our north star:

Our culture

With our people in mind, we have created a culture that fosters authenticity, collaboration, innovation and development. We empower one another, make meaningful contributions that not only impact the organization, but our country We develop and nurture meaningful connections that drive innovation in our ecosystem. We are Payments Canada

Do you want to make payments easier, smarter and saferfor Canada? Join us today

You need to work here if

• You love working with passionate, ambitious and collaborative colleagues.
• You want to be challenged and lead unique initiatives.
• You want to grow, develop and become a subject matter expert in your field.
• You want your work to make an impact in your community and country.

Come and join us — where payments meet purpose

What we are looking for

Reporting to the Director, Cyber Security & Operations, the Senior Analyst, Vulnerability Operations plays a vital, strategic role in safeguarding Payments Canada's modern infrastructure. The main responsibility of the Senior Analyst, Vulnerability Operations is to lead and mature the cyber vulnerability management program. This is not a siloed, backend technical role; it requires a highly personable technical leader who can translate complex vulnerability data (including CVEs, KEVs, and AI-specific exploits) into strategic business risks. The ideal candidate balances deep technical acumen with exceptional thought leadership to guide both internal teams and external financial sector partners.

The core mission of this role is to lead, scale, and mature our cyber vulnerability management program from traditional infrastructure monitoring to an agile framework capable of defending against threats in an AI world. Specifically, the incumbent will be responsible for managing vulnerabilities across applications, as well as on premise and cloud-based infrastructure.

Responsibilities of the position includes but is not limited to the following:

Research, Analysis & Thought Leadership

• Conduct in-depth vulnerability research and analysis.
• Produce timely, consolidated, multi-source vulnerability intelligence reports (e.g., vulnerability assessments, briefings,).
• Conduct deep-dive research into emerging vulnerability trends, specifically focusing on the intersection of cybersecurity and Frontier AI (e.g., adversarial machine learning, LLM vulnerabilities, and AI supply chain risks).
• Translate highly technical vulnerability findings into clear, risk-quantified business narratives for executive leadership and board-level consumption.

Vulnerability Management & Operations

• Monitor vulnerabilities through a variety of tools and sources and rank them according to relevance to Payments Canada.
• Collaborate with internal stakeholders to define vulnerability operations requirements.
• Own, design, and mature the end-to-end vulnerability management lifecycle, evaluating and optimizing SLAs for remediation across corporate and payment systems.
• Evolve traditional risk-ranking methodologies by combining CVE and KEV scores with real-world threat intelligence and AI-specific threat modeling (e.g., MITRE ATLAS).
• Establish automated workflows and monitoring plans to ingest, filter, and prioritize massive data streams of threat and vulnerability data efficiently.
• Report any imminent vulnerabilities to the organization in a timely manner.
• Coordinate the response, including reporting, on vulnerabilities to multiple levels of stakeholders.

Engagement with the Organization & External partners

• Provide cyber-focused guidance and vulnerability operations support to internal stakeholders.
• Faci